Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: Ransomware is usually the outcome of an earlier access failure, not the root problem itself, and Knowbe4’s whitepaper argues that social engineering, phishing, and unpatched software remain the most common entry paths. The implication is that reducing blast radius means tightening identity controls and patch discipline before attackers turn initial access into operational disruption.
NHIMG editorial — based on content published by Knowbe4: Whitepaper on the root causes of ransomware
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams limit ransomware spread through identity controls?
A: Security teams should reduce standing privilege, segment admin roles, and require task-scoped elevation for high-risk actions.
Q: Why do unpatched systems remain such a common ransomware entry point?
A: Because they let attackers skip social engineering and move straight to code execution on reachable systems.
Q: What do organisations get wrong about ransomware recovery?
A: Many organisations treat recovery as a storage or backup problem and underweight identity control.
Practitioner guidance
- Harden phishing-resistant authentication Require phishing-resistant MFA for all accounts that can reach privileged systems, administrative consoles, or recovery functions, and review where fallback methods still allow simple credential replay.
- Shrink the patch exposure window Prioritise internet-facing services, remote access tooling, and known exploited vulnerabilities first, then track time-to-remediation as a resilience metric.
- Limit privilege amplification paths Remove standing administrative access from accounts that do not need it, segment backup and recovery systems, and test whether a compromised user can reach critical restoration controls.
What's in the full report
Knowbe4's full whitepaper covers the operational detail this post intentionally leaves for the source:
- The article's breakdown of common ransomware entry points and how they map to human error or exposed software.
- Roger Grimes's discussion of why social engineering remains a durable access path for ransomware crews.
- The source's mitigation tips for reducing ransomware risk across user behaviour, patching, and defensive controls.
👉 Read Knowbe4's whitepaper on the root causes of ransomware →
Ransomware root causes: what IAM and security teams need to act on?
Explore further
02/08/2026 1:02 pm
Ransomware is an access-control failure before it is an encryption event. The whitepaper's central point is that phishing, social engineering, and unpatched software create the opening that ransomware operators need. For identity teams, that means the control problem starts at authentication, user behaviour, and patch exposure rather than at the moment the payload executes. Practitioners should treat ransomware as an access governance issue, not only a malware category.
A question worth separating out:
Q: Who is accountable for closing the access gaps that ransomware exploits?
A: Accountability usually spans CISO, IAM, endpoint, and infrastructure owners because ransomware crosses multiple control domains. The practical test is whether each team owns a specific part of the attack path, from phishing resistance and patching through to privileged recovery access. Shared responsibility only works when those boundaries are explicit and measurable.
👉 Read our full editorial: Ransomware root causes still start with human and software gaps
